OAuth consent phishing
User tricked into authorising a malicious app that receives durable tokens
categoryIdentity, authentication and credential attacksseverityHighdetectabilityHighlabnot yet measured
Example: Salesforce C0059
Classification
32 values: 9 reviewed, 16 imported, 7 derived. What do these mean?
Exploitability
| Attack vector | Credential attacks |
|---|---|
| Reach (CVSS) | |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | Active |
| Attacker skill required | Low |
| Resources required | Low |
| Likelihood / prevalence | High |
| Maturity | Commoditized |
Impact & scope
| Severity | High |
|---|---|
| Impact | ConfidentialityIntegrity |
| Platform | ContainersIaaSIdentity ProviderOffice SuiteSaaS |
| Environment | Cloud |
| Target asset class | HumanIdentity |
| Kill-chain phase (tactic) | Credential AccessPersistence |
Detection & telemetry
| Detectability | High |
|---|---|
| Testability | Atomic Red Team test |
| Data sources (ATT&CK data components) | Active Directory Object ModificationApplication Log ContentCloud Service EnumerationCloud Service ModificationCloud Storage AccessFile AccessUser Account Authentication |
Detection & response
Mitigated by 16
- M1017 attack-mitigation
- M1018 attack-mitigation
- M1021 attack-mitigation
- M1042 attack-mitigation
- M1047 attack-mitigation
D3-ANCId3fendD3-CCSAd3fendD3-CHd3fendD3-CRd3fendD3-CROd3fendD3-CTSd3fendD3-DUCd3fendD3-MFAd3fendD3-RICd3fendD3-TBd3fendD3-TBAd3fend
Detected by 16
- DET0515 attack-detection-strategy
- DET0539 attack-detection-strategy
0055ad1f-be85-4798-83cf-a6da17c993b3sigma0adc67e0-a68f-4ffd-9c43-28905aad5d6asigma25cde13e-8e20-4c29-b949-4e795b76f16fsigma53acd925-2003-440d-a1f3-71a5253fe237sigma6555754e-5e7f-4a67-ad1c-4041c413a007sigma65744385-8541-44a6-8630-ffc824d7d4ccsigma6d3a3952-6530-44a3-8554-cf17c116c615sigma7091372f-623c-4293-bc37-20c32b3492besigma8a4519e8-e64a-40b6-ae85-ba8ad2177559sigma9b2cc4c4-2ad4-416d-8e8e-ee6aa6f5035asigmaa6355fbe-f36f-45d8-8efc-ab42465cbc52sigmaa84fc3b1-c9ce-4125-8e74-bdcdb24021f1sigmac1d147ae-a951-48e5-8b41-dcd0170c7213sigmad2eb17db-1d39-41dc-b57f-301f6512fa75sigma
Tested by 2
67aaf4cb-54ce-42e2-ab56-e0a9bcc089b1atomic9a5352e4-56e5-45c2-9b3f-41a46d3b3a43atomic
Framework references
- Primary source: https://attack.mitre.org/techniques/T1671/
- attack: T1528 (primary)
- attack: T1671
Evidence & sources
- ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Identity, authentication and credential attacks' table, line 351 of Cyber-Attack-Taxonomy.md
- ev-0002 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 1 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)
- ev-0003 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 13 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)